Description
A vulnerability has been identified in Opcenter Quality (All versions < V2406), Opcenter RDnL (All versions < V2410), SIMATIC PCS neo V4.0 (All versions), SIMATIC PCS neo V4.1 (All versions < V4.1 Update 2), SIMATIC PCS neo V5.0 (All versions < V5.0 Update 1), SINEC NMS (All versions), SINEMA Remote Connect Client (All versions < V3.2 SP3), Totally Integrated Automation Portal (TIA Portal) V16 (All versions), Totally Integrated Automation Portal (TIA Portal) V17 (All versions < V17 Update 8), Totally Integrated Automation Portal (TIA Portal) V18 (All versions < V18 Update 5), Totally Integrated Automation Portal (TIA Portal) V19 (All versions < V19 Update 3). Affected products contain a heap-based buffer overflow vulnerability in the integrated UMC component. This could allow an unauthenticated remote attacker to execute arbitrary code.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Siemens | Opcenter Quality | < V2406 | V2406 |
| Siemens | Opcenter RDnL | < V2410 | V2410 |
| Siemens | SIMATIC PCS neo V4.0 | — | — |
| Siemens | SIMATIC PCS neo V4.1 | < V4.1 Update 2 | V4.1 Update 2 |
| Siemens | SIMATIC PCS neo V5.0 | < V5.0 Update 1 | V5.0 Update 1 |
| Siemens | SINEC NMS | — | — |
| Siemens | SINEMA Remote Connect Client | < V3.2 SP3 | V3.2 SP3 |
| Siemens | Totally Integrated Automation Portal (TIA Portal) V16 | — | — |
| Siemens | Totally Integrated Automation Portal (TIA Portal) V17 | < V17 Update 8 | V17 Update 8 |
| Siemens | Totally Integrated Automation Portal (TIA Portal) V18 | < V18 Update 5 | V18 Update 5 |
| Siemens | Totally Integrated Automation Portal (TIA Portal) V19 | < V19 Update 3 | V19 Update 3 |
Advisories 4
- ICSA-24-256-03 Siemens User Management Component (UMC) CISA ICS & IT advisories · Oct 14, 2025
- SSA-039007 SSA-039007: Heap-based Buffer Overflow Vulnerability in User Management Component (UMC) Siemens ProductCERT · Oct 14, 2025
- NCSC-2024-0362 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Sep 10, 2024
- WID-SEC-2024-2093 Siemens TIA Portal: Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Sep 9, 2024